Pseudonymize medical documents before AI, without them leaving your computer.
Hexagone AI is French pseudonymization software for healthcare professionals that runs entirely on their own computer. It removes names, social security numbers, dates, addresses and phone numbers from reports, letters and patient files before Claude, ChatGPT, Mistral or any other AI reads them, then re-identifies the answer locally. It is the check France's national health authority (HAS) asks professionals to make before every request to a generative AI.
Summarising a record, writing a referral letter, reviewing a protocol, preparing a multidisciplinary meeting: generative AI saves time on documents that are, almost all of them, covered by medical confidentiality. Hexagone AI prepares a copy where nothing identifies the patient, scanned PDFs and handwritten forms included.
What your profession's rules say about AI
- French Public Health Code, article L1110-4
"Every person cared for by a health professional, establishment or health service […] is entitled to respect for their private life and to the secrecy of information concerning them." (our translation)
Secrecy covers all information about the patient, not only the diagnosis.
- HAS, "First keys for using generative AI in health" (October 2025), key 2.4
"Whenever a generative AI system is accessible over the internet or without assurance that data confidentiality is respected, check in every request that no information allowing direct or indirect identification, or covered by medical secrecy, is shared." (our translation)
The HAS gives as examples surnames, first names, initials, dates, postal and email addresses, phone and social security numbers. That is exactly what Hexagone AI removes, on every request, without relying on everyone's vigilance.
- Medical Code of Ethics, article R.4127-13-1 (decree no. 2026-691 of 27 July 2026)
When a physician uses artificial intelligence, "they implement the precautions essential to guarantee […] the security and confidentiality of their health data". (our translation)
Since summer 2026, the precaution is no longer only good practice: it is written into physicians' code of ethics.
- CNIL (French data protection authority), Q&A on using a generative AI system (July 2024)
"Never share confidential information such as personal data […] when using a consumer service", and "favour deploying on-site (on premise) solutions". (our translation)
The step that sees the real identities, detection, is the one Hexagone AI keeps on your computer.
- French Public Health Code, article L1111-8 (HDS)
The certification requirement covers "any person who hosts personal health data collected during prevention, diagnosis, care or social and medico-social follow-up" on behalf of others. (our translation)
Our reading: sending identifying health data to an online AI service raises the question of that data being hosted by a third party. Processing the document on your own computer, then sending only a pseudonymised copy, avoids having the original data hosted elsewhere. Check your own situation with your DPO.
- French Penal Code, article 226-13
Disclosure of secret information by the person entrusted with it "is punishable by one year's imprisonment and a fine of 15,000 euros". (our translation)
Medical confidentiality is protected by criminal law, on top of ethical obligations.
A discharge summary holds a name, a date of birth, a social security number, an address, the GP's name and a clinical history. Pasting it into a consumer AI assistant hands identifying health data to a company that is not bound by medical confidentiality.
The HAS asks for every request to be checked. In practice, on a fifty-page record made of scanned PDFs, handwritten Cerfa forms and stamped letters, a check by eye always lets something through.
Online anonymisation tools solve the volume problem, but the original document goes to their server to be processed. For health data, that is exactly the transfer you are trying to avoid.
How it works
Open the document or the record
PDF, scanned ones included thanks to local OCR, Word, Excel, PowerPoint, text. One report or a whole directory.
Detection runs on your computer
Identifiers are replaced with neutral markers or realistic substitutes. The same patient keeps the same pseudonym across every document, so the AI can follow their care pathway.
You review before exporting
Every detection appears in the preview pane, and you can correct anything before exporting the protected copy, rebuilt with its original layout.
The AI works on the copy
Claude, ChatGPT, Mistral, Copilot: the AI reads a document where nothing identifies the patient. The clinical content stays readable.
The answer is re-identified locally
The mapping never leaves your computer. Hexagone AI puts the real identities back into the answer, on your machine.
What gets replaced
- Names of patients, relatives and caregivers, initials
- Names of hospitals, clinics and practices
- Postal addresses, emails and phone numbers
- Social security (NIR), passport and tax numbers
- Dates of birth and other identifying dates
- IBANs and amounts
- Record numbers and references
- Your own entity types, which you define yourself
Frequently asked questions
- Can a doctor use ChatGPT on a patient record?
- The HAS asks, whenever a generative AI system is accessible over the internet or without a confidentiality guarantee, that every request be checked so that no information allowing direct or indirect identification is shared. Since the decree of 27 July 2026, the medical code of ethics also requires a physician using AI to take the precautions essential to guarantee the confidentiality of health data. Using an AI on a document pseudonymised beforehand respects that framework; pasting the raw record does not.
- How accurate is detection on medical documents?
- We measured it on 200 French medical documents from the PARHAF corpus (Health Data Hub / AP-HP, CC BY 4.0): 246 pages and 6,718 labelled identifiers, two thirds delivered as 200 dpi scans with handwriting. Processed as a single batch through the Hexagone AI API, 98.6% of direct identifiers were found and 0.04% remained readable in the delivered file. The full methodology is on our research page.
- Do I need an HDS-certified host to use Hexagone AI?
- The desktop app processes documents on your own computer and hosts them nowhere: at that stage there is no hosting of health data on behalf of others. That is our reading of article L1111-8 of the Public Health Code, not an official position: have it confirmed by your DPO, especially for the AI tool you then send the pseudonymised copy to.
- Is pseudonymised health data still personal data?
- For you, yes: you hold the mapping, so the GDPR still applies. Pseudonymisation is a security measure the GDPR names explicitly (articles 25 and 32). The HAS also points to indirect identification: a rare condition in a small town can be enough. That is why the copy is reviewed before sending.
- Is Hexagone AI a French company?
- Yes. HEXAGONE AI is a French SAS registered in Nanterre (SIREN 989 062 849), headquartered in Boulogne-Billancourt, founded in 2025 by Mariia Zameshina and Romain Boudet. The desktop software transmits no document.
- How much does Hexagone AI cost?
- €49 excl. VAT per user per month billed annually (€59 monthly) for Starter, €79 (€99 monthly) for Pro. One week's free trial, no credit card: you can test it on a real document, since nothing is uploaded.
Try it on a real file.
One week free, no credit card. Nothing is uploaded, so you can run it on a real file without asking anyone's permission.
macOS Apple Silicon and Windows 10/11